ClawHub
Back to skill

Security audit

Provenote MCP Outcome Workflows

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Provenote MCP skill with disclosed local setup and read-first workflows, though users should approve any writes or settings changes explicitly.

Install only from a Provenote repository you trust, use an absolute path to your local clone, start with draft.list, research_thread.list, and auditable_run.list, and approve each write, download, chat, or settings mutation one at a time.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill is described as supporting 'read-first outcome workflows', but this capabilities document explicitly includes state-changing operations such as create, promote, mutate, and download. That mismatch can cause an agent or host to grant broader permissions than users expect, increasing the chance of unauthorized writes, workflow manipulation, or data exfiltration through output generation and downloads.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
Documenting `settings.mutate` as a general utility surface is dangerous because configuration mutation is not clearly necessary for a workflow centered on inspecting drafts, research threads, and auditable runs. A model following this guidance could alter host or server settings, expand access, change endpoints, or weaken safeguards, making this more dangerous than ordinary read/write workflow actions in the stated context.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger phrase `research thread` is generic and likely to appear in many unrelated user requests, causing the skill to activate outside Provenote-specific contexts. Unintended activation can steer an agent toward installing or configuring an MCP server and using external tooling when the user only meant the phrase descriptively.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger phrase `auditable run` is also generic and may collide with normal requests about traceability, testing, or reproducible workflows. In this skill, accidental invocation is mildly risky because the content teaches local MCP server setup and workflow actions, which could inappropriately shape the agent's behavior in unrelated tasks.

Static analysis

No suspicious patterns detected.